HijackThis only scans certain areas of a computer's system/registry
to help diagnose the presence of undetected malware in known hiding places. Given the sophistication of malware hiding techniques used by attackers in today's environment, HijackThis is limited in its ability to detect infection
and generate a report outside these known hiding places. This limitation has made its usefulness nearly obsolete
since a HijackThis log cannot reveal all the malware residing on a computer. As such, HijackThis has been replaced by other preferred tools
that provide comprehensive logs with specific details about more areas of a computer's system, files, folders and registry keys which may have been modified by malware infection.
Preliminary scans from these tools should be used before ComboFix. Analysis of those logs allows planning an strategy for effective disinfection and a determination if using ComboFix is necessary. If you have not already done so, you should read this topic
about ComboFix usage.
Most anti-rootkit scanners (ARKs) do not work on 64-bit systems and conventional Kernel-mode Rootkits
are not usually able to infect a 64-bit systems so they are less prone to that type of infection. Due to the architecture in 64-bit windows, drivers need to be digitally signed. Windows 64-bit enforces driver signing and utilizes Kernel Patch Protection
(Patchguard) which does not permit the installation of unsigned kernel level drivers. For more specific information about Patchguard, please refer to:
Since drivers need to be specific, 32-bit drivers do not run on a 64-bit operating system. As such, tools like GMER and Root Repeal which need to install kernel level drivers to operate, do not function fully on 64-bit machines and therefore they are not useful tools for such systems. Although GMER can run on a 64-bit version of Windows only registry, services and files can be scanned...other options are grayed out.
There are many free anti-rootkit tools but some of them require a certain level of expertise and investigative ability to use. These are a few of the easier ARKS for novice users:Malwarebytes Anti-Malware
uses a proprietary low level driver (similar to some ARK detectors) to locate hidden files and special techniques which enable it to detect a wide spectrum of threats including active rootkits. SUPERAntiSpyware Free
offers technology to deal with rootkit infections as well.